Computer security is becoming an increasingly important issue as more and more reliance is placed on computers to manage important information. The increasing threat of viruses has required that systems provide adequate protection against both known and unknown threats.
The present system and method for providing computer security relate primarily to the Microsoft Windows®-based operating system platforms, including, but not limited to, Windows XP,® Windows Vista,® Windows 7,® Windows Server 2008,® which are tied to the Intel,® Itanium,® and AMD® processors with an Intel 8086®-based or RISC-based instruction set, register, and memory configurations. The present system and method particularly relate to both the 32-bit and the 64-bit versions of these operating systems in which more robust features are provided. However, the principles established herein are do not specifically require Windows or the specific hardware platforms noted above, and the invention is not to be construed as so limiting. Numerous other embodiments are contemplated.
In the 32-bit Windows architectures, an application running in user-mode can chain (patch) into a system call table via a known user-mode application program interface (API). The problem with this approach is that a malicious application can chain into the system call table and from there easily infect almost any part of the system.
In the 64-bit version of Windows, a feature called the Kernel Patch Protection (KPP), (informally known as “PatchGuard”) was implemented that does not allow alteration of the operating system code itself, making the system more secure and less vulnerable to malicious code. However, since some useful programs rely on patching the OS in order to work properly, these applications do not work on the 64-bit version.
For both the 32-bit and the 64-bit versions of Windows, anti-virus and anti-spyware software is needed, since it is possible to install programs that can give an attacker access to, and control over, the system, merely by clicking on a link in an e-mail or by visiting a malicious website containing malware.
Conventional anti-virus and anti-malware software relies on signatures, or specific attributes of malware to detect viruses and malware and to defend against them. Such signatures could be, e.g., a specific series of instructions or a data field that is consistent across copies of the virus payload. However, new so-called “polymorphic” and automatically self modifying malware can get around these protections by changing their signature dynamically. Criminal enterprises have formed and are currently using these techniques to invade Windows-based systems and steal passwords and account information; in some cases such techniques have been used to steal hundreds of thousands of dollars using online banking credentials that were stolen.
Furthermore, the zero-day problem also negates signature-based anti-virus and anti-malware solutions. The zero-day problem is the day on which a virus or malicious software is first introduced into the general population. On the first day, no analysis has been performed on the threat and no potential signatures have been identified and provided in the anti-virus program databases.
Previous attempts to protect against this sort of malware have been based on a separate area of memory or physical disk where all changes to the system are recorded and mapped to the “actual” files, so that changes are not committed to the actual system files, but rather the temporary image of those files. However, these systems have significant limitations in their ability to function, and some cannot function at all on the 64-bit platform because of their reliance on using routines that can be considered security risks.
What is needed is a kernel-mode product for both 32-bit and 64-bit Windows platforms which allows users to selectively isolate processes from sensitive areas in the operating system. The important components that are protected through isolation may include the file system, the system registry, named pipe and mail slot access, socket-based connections, and port-communications,
Port based accesses may be filtered for isolated processes. The actions which isolated processes can perform over these ports, such as asking the caller about the connections, not registering any ports which can be used for call back from the outside, etc. can be provided as well.